ARM: prevent VM_GROWSDOWN mmaps extending below FIRST_USER_ADDRESS

Cc: <stable@vger.kernel.org>
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

1 files changed, 3 insertions, 1 deletions

diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index f07467533365..5bb48356d217 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -247,7 +247,9 @@ good_area:
         return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
 
 check_stack:
-        if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
+        /* Don't allow expansion below FIRST_USER_ADDRESS */
+        if (vma->vm_flags & VM_GROWSDOWN &&
+            addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
                 goto good_area;
 out:
         return fault;